Cybersecurity Policy Report, U.K. Privacy Office Offers Guidance on Handling Complaints, (Feb 13, 2026)
By Tony Foley
The United Kingdom’s Information Commissioner’s Office (ICO) has published updated guidance for organizations advising them what they need to do to meet new requirements related to the process of handling data protection complaints as set forth in the recently enacted Data (Use and Access) Act.
ICO published the updated guidance yesterday, noting that, while the new requirements would not come into force until June 19, it believed that the update would be useful to prepare organizations to comply with them. The guidance clarifies that organizations must have a process for handling data protection complaints, with no applicable exceptions. Specifically, data protection law provides that organizations must give people a way of making data protection complaints, acknowledge the receipt of a complaint within 30 days of receipt, take appropriate steps to respond to complaints, including making appropriate inquiries and keeping people informed, and tell people the outcome without undue delay.
The guidance points out that the law does not require organizations to set up a separate tool for complaint handling, provided they are able to meet their obligations. The ICO recommends that organizations consider and provide for how they will respond to complaints filed through social media or received from children. After acknowledging receipt of a complaint, the organization must initiate an investigation and keep specified records concerning its findings. When notifying complainants of the results of an investigation, organizations should clearly explain the actions taken and should consider providing more detail if the complainant is unhappy with the determination. Finally, it is a good practice to inform a dissatisfied complainant of their right to complain to the ICO and to provide contact details.
The guidance concludes by advising organizations that if someone tells them that they plan to raise a complaint with the ICO, the organization does not need to inform ICO. Instead, ICO will reach out directly to the organization if more information is needed and will ask the complainant to reach out to the organization before the ICO initiates its own investigation.
News: InternationalLegislation DataPrivacy DataSecurity